{"full_name":"caddyserver/caddy","owner":"caddyserver","name":"caddy","url":"https://github.com/caddyserver/caddy","description":"Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS","homepage":"https://caddyserver.com","topics":[],"language":"Go","license":"Apache-2.0","avatar":"https://avatars.githubusercontent.com/u/12955528?v=4","created_at":"2015-01-13T19:45:03Z","pushed_at":"2026-11-10T09:09:18Z","metrics":{"stars":78943,"forks":5252,"watchers":867,"issues":4728,"prs":3361,"releases":140,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":0},"growth":{"day":{"stars":30,"forks":2,"base_day":"2026-11-09"},"week":{"stars":286,"forks":20,"base_day":"2026-11-03"},"month":{"stars":1943,"forks":182,"base_day":"2026-10-11"}},"history":{"dates":["2026-09-06","2026-09-07","2026-09-08","2026-09-09","2026-09-10","2026-09-11","2026-09-12","2026-09-13","2026-09-14","2026-09-15","2026-09-16","2026-09-17","2026-09-18","2026-09-19","2026-09-20","2026-09-21","2026-09-22","2026-09-23","2026-09-24","2026-09-25","2026-09-26","2026-09-27","2026-09-28","2026-09-29","2026-09-30","2026-10-01","2026-10-02","2026-10-03","2026-10-04","2026-10-05","2026-10-06","2026-10-07","2026-10-08","2026-10-09","2026-10-10","2026-10-11","2026-10-12","2026-10-13","2026-10-14","2026-10-15","2026-10-16","2026-10-17","2026-10-18","2026-10-19","2026-10-20","2026-10-21","2026-10-22","2026-10-23","2026-10-24","2026-10-25","2026-10-26","2026-10-27","2026-10-28","2026-10-29","2026-10-30","2026-10-31","2026-11-01","2026-11-02","2026-11-03","2026-11-04","2026-11-09","2026-11-10"],"stars":[75175,75199,75225,75252,75269,75290,75319,75395,75416,75453,75483,75505,75553,75578,75592,75620,75654,75679,75732,75764,75791,75824,75839,75858,75925,75996,76029,76054,76078,76094,76142,76163,76213,76234,76261,77000,77396,77476,77539,77616,77687,77846,77910,77964,78023,78051,78075,78153,78190,78227,78270,78317,78357,78433,78478,78522,78544,78570,78657,78694,78913,78943],"forks":[4905,4910,4912,4916,4917,4921,4926,4933,4936,4939,4938,4942,4946,4945,4946,4951,4952,4952,4958,4963,4965,4968,4970,4974,4986,4990,4992,4997,5000,5002,5014,5018,5022,5023,5028,5070,5091,5096,5101,5106,5111,5125,5134,5141,5143,5146,5149,5157,5165,5169,5163,5168,5174,5179,5189,5199,5207,5213,5232,5241,5250,5252],"watchers":[864,864,864,864,864,864,865,868,868,868,868,868,866,866,866,866,865,865,864,865,865,865,865,865,867,866,866,868,867,867,865,865,865,865,865,868,869,869,870,870,870,870,869,871,871,871,871,871,871,871,872,873,869,870,870,870,869,869,869,869,867,867],"issues_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"prs_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]},"boards":{},"same_owner":[{"full_name":"caddyserver/certmagic","name":"certmagic","boards":{}}],"issues":[{"number":6683,"title":"fatal error: concurrent map read and map write after upgrading 2.7.6 to 2.8.4 and/or adding github.com/caddyserver/cache-handler","comments":46,"created_at":"2024-11-10T19:25:39Z"},{"number":7147,"title":"ACME broken for .internal adresses","comments":44,"created_at":"2025-07-29T17:43:03Z"},{"number":6678,"title":"Requests aborted over HTTP/3","comments":35,"created_at":"2024-11-05T22:55:12Z"},{"number":7249,"title":"Output a lot of information and exit automatically","comments":31,"created_at":"2025-09-10T08:00:21Z"},{"number":5280,"title":"possible bug with 1xx status code handling","comments":28,"created_at":"2023-01-02T20:25:16Z"},{"number":7222,"title":"Preserve active websocket connections when unrelated routes are updated","comments":22,"created_at":"2025-08-29T07:18:32Z"},{"number":5116,"title":"Support \"precompressed\" files without \"base\" files","comments":22,"created_at":"2022-10-03T22:14:43Z"},{"number":4016,"title":"Better control over Prometheus metrics","comments":22,"created_at":"2021-02-12T09:56:38Z"}],"discussions":[],"latest_release":{"name":"v2.11.9","tag":"v2.11.9","published_at":"2026-11-05T01:30:24Z","body":"This is a quick follow-up on top of 2.11.8, to fix a regression it introduced and a few more security issues, mostly in FastCGI. It contains only fixes backported from master, plus a couple of small additions. **If you're on 2.11.8 and serve PHP, we recommend upgrading.**\r\n\r\n**Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.**\r\n\r\n## Highlights\r\n\r\n- **Fixed: PHP directory indexes (regression in 2.11.8).** A request for a directory with a trailing slash, like `/wp-admin/`, was matched by the directory itself instead of its `index.php`, so it never reached PHP and usually got a 404. This broke WordPress admin pages and other apps that serve an index through a trailing-slash URL. A `try_files` pattern now only matches a directory when it ends in `/`. Thanks @dunglas! (#8352)\r\n- **Path matchers with placeholders** now work as expected: placeholders like `{env.FOO}` are no longer lower-cased into `{env.foo}` before they're looked up, and their values are compared case-insensitively against the request path, like static patterns. Thanks @BenMacha! (#8343)\r\n- **New `plain_time_format` option for [`file_server browse`](https://caddyserver.com/docs/caddyfile/directives/file_server):** sets the time layout of plain-text directory listings (`Accept: text/plain`). Thanks @steffenbusch! (#8084)\r\n- **Fewer allocations** in path cleaning, header rewriting and `weighted_round_robin` selection. Thanks @jvoisin! (#7842)\r\n- **For plugin authors:** new `httpcaddyfile.Helper.IsNamedRoute()` tells a directive whether it's being parsed inside a [named route](https://caddyserver.com/docs/caddyfile/concepts#named-routes). (#8354)\r\n\r\n## :warning: Breaking changes\r\n\r\n- **Conflicting `client_auth` is now a Caddyfile error.** When two site blocks share TLS connection policies for the same hostname but set different `client_auth`, the adapter used to keep the first one and silently drop the other, which could quietly remove a stricter mTLS requirement. (#8306)\r\n- **FastCGI requests that are ambiguous about which script they run get `400`:**\r\n  - when the escaped path (which `%`-containing path matchers see) and the decoded path would select different scripts, e.g. `/public/tool.php%2f..%2f..%2fadmin%2ftool.php` (#8357)\r\n  - on Windows, script paths with an 8.3 short name component (like `ADMINI~1`) or a `:` (NTFS alternate data streams) (#8356)\r\n- **FastCGI `env` values now take precedence over request headers**, so a client can no longer override `HTTP_*` variables you set with `env` (see below). (#8358)\r\n\r\n## Security fixes\r\n\r\nThank you to everyone who reported responsibly and helped with patches:\r\n\r\n- fastcgi: A client could override any `HTTP_*` variable set with the FastCGI transport's (or `php_fastcgi`'s) `env` subdirective by sending a matching request header, for example choosing the user an application sees in `HTTP_X_AUTH_USER`. Configured values now win. Reported by @JebeenLee and @Camel4, fixed by @dunglas. (GHSA-q34h-28rj-5hjm, #8358)\r\n- fastcgi: On Windows, NTFS 8.3 short names and alternate data streams could run a script that a path rule was meant to deny, completing the FastCGI fix from 2.11.8. Thanks @dunglas. (GHSA-9cr8-wmhh-39pm, #8356)\r\n- fastcgi: Encoded slashes and dot segments could make a `%`-containing path matcher approve one script while another one runs. Thanks @dunglas. (#8357)\r\n- fastcgi: Over HTTP/2, a `host` field sent next to `:authority` could make the application see a different host (`HTTP_HOST`) than the one Caddy routed the request to. Thanks @dunglas. (#8355)\r\n- httpcaddyfile: A stricter `client_auth` could be silently dropped when merging TLS connection policies (see above). Thanks @sam-kota. (#8306)\r\n- Updated `go-jose` to v4.1.6 for GHSA-mgcc-cww5-fp2q. (#8299)\r\n\r\n:warning: These security patches may be breaking if your application relies on the buggy behaviors.\r\n\r\n:rotating_light: **Notice for Cad"},"readme":true,"readme_zh":false,"news":[{"title":"Caddy Proposal: Permanently change all proprietary licensing to open source","url":"https://github.com/caddyserver/caddy/issues/2786","hn":"https://news.ycombinator.com/item?id=21154893","source":"Hacker News","lang":"en","date":"2019-10-04","points":357,"comments":76},{"title":"Caddyhttp: Enable HTTP/3 by Default","url":"https://github.com/caddyserver/caddy/pull/4707","hn":"https://news.ycombinator.com/item?id=32768454","source":"Hacker News","lang":"en","date":"2022-09-08","points":284,"comments":115},{"title":"Show HN: Caddy v2.5.0","url":"https://github.com/caddyserver/caddy/releases/tag/v2.5.0","hn":"https://news.ycombinator.com/item?id=31170280","source":"Hacker News","lang":"en","date":"2022-04-26","points":269,"comments":112},{"title":"Caddy 2.8","url":"https://github.com/caddyserver/caddy/releases/tag/v2.8.0","hn":"https://news.ycombinator.com/item?id=40517576","source":"Hacker News","lang":"en","date":"2024-05-29","points":179,"comments":75},{"title":"Caddy 2.6 is out, the biggest release since Caddy 2","url":"https://github.com/caddyserver/caddy/releases/tag/v2.6.0","hn":"https://news.ycombinator.com/item?id=32916272","source":"Hacker News","lang":"en","date":"2022-09-20","points":56,"comments":7},{"title":"It's here Caddy 2 is ready for production","url":"https://github.com/caddyserver/caddy/releases/tag/v2.0.0","hn":"https://news.ycombinator.com/item?id=23070846","source":"Hacker News","lang":"en","date":"2020-05-04","points":21,"comments":1},{"title":"Caddy v2.10","url":"https://github.com/caddyserver/caddy/releases/tag/v2.10.0","hn":"https://news.ycombinator.com/item?id=43732666","source":"Hacker News","lang":"en","date":"2025-04-18","points":11,"comments":1},{"title":"Caddy Server: Smarter path matching and rewriting (PR)","url":"https://github.com/caddyserver/caddy/pull/4948","hn":"https://news.ycombinator.com/item?id=32442593","source":"Hacker News","lang":"en","date":"2022-08-12","points":8,"comments":0},{"title":"Caddy offers TLS, HTTPS, and more in one dependency-free Go Web server","url":"https://arstechnica.com/gadgets/2020/05/caddy-offers-tls-https-and-more-in-one-dependency-free-go-web-server/","source":"Ars Technica","lang":"en","date":"2020-05-05"},{"title":"How to install Buzz app on a VPS","url":"https://news.google.com/rss/articles/CBMiZ0FVX3lxTFBLc09SekVRN0FYUENCQzJuQ0xveG1tNnR3ZFdBQVJKekUzeTVCcUdlSzJ3bGJVRnVNRDRRRXhnWVBaZGdXejFSVzBNS213NHdXNlFMWWp1SWFZQ2cxNVdkdENaUUl6SEk?oc=5","source":"Hostinger","lang":"en","date":"2026-07-31"},{"title":"Twenty CRM: GitHub 上 44,000 颗星的 Salesforce 开源替代方案","url":"https://news.google.com/rss/articles/CBMinwFBVV95cUxOTWVJR2x4cnhRUUc2YzduWmoyZ3QxWVRtZ0FjN3hjSWdUZEVBbXhndWttcGM4eVlLSk82MUlyUmxIU19NUGVleWR2a3lSS2JuVnoxdlVadkNEdEpuZm9tWWRtN0wxQ2h6N2RpUXIwSy1xb1BCeV9VNVhMaWZjSVdUQ1pzQm4ySjVyNXpROUszbGpud2N0MVR0Q2NzNVJYb3M?oc=5","source":"Pasquale Pillitteri","lang":"zh","date":"2026-04-17"},{"title":"Nginx Pulse：一款支持 Nginx/Envoy/Caddy 等主流代理的全能日志分析工具","url":"https://news.google.com/rss/articles/CBMiZ0FVX3lxTE5RWFMySmNQSk9SeHpEQkxyT1hwVXhPSkIwM3JFMzFhYVJrR2wtSndYem9lUEF6bm01RjNIQnZwTzNnT0toMzVWaUwxei1oTlhtY3VPWEE2VXlSVnNnZ3d1MFdJVThPT2M?oc=5","source":"www.80aj.com","lang":"zh","date":"2026-02-05"}],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}